feat(nix): self-contained flake + nix flake check as CI

[schickling-assistant]

What

A self-contained flake.nix, and convoy's first CI — which is the same thing: nix flake check is the gate.

Stacked on #85. This PR's base is the completions branch, because checks.completions runs convoy completions <shell> on the built binary. Merge #85 first.

Also blocked on compoundingtech/smalltalk#104. smalltalk's flake does not exist on its main yet, so the smalltalk input points at that PR's branch, with a # TODO: to repoint once it merges. That is the other reason this cannot merge yet.

The flake

Thin and self-contained. Inputs: nixpkgs, flake-utils, pty and smalltalk from their own flakes (both with nixpkgs followed, and smalltalk.inputs.pty followed so there is exactly one pty in the closure). No first-party tooling deps — it builds standalone from a bare checkout.

• Builds from self, so it packages the revision it ships with rather than a pinned fetchFromGitHub.
• Version from package.json (0.2.0-ts.0) — a release bump needs no edit here.
• Sibling links are declarative: an npm-name -> store-path attrset, rendered into node_modules by a shared linkSiblings helper, instead of ad-hoc ln -s lines. The names are @compoundingtech/pty and @compoundingtech/smalltalk, matching package.json/package-lock.json after 795b9be — coord is gone entirely.
• Completions are generated at build time from the just-built binary and installed with installShellCompletion, so what ships can never drift from src/command-table.ts.
• meta.mainProgram = "convoy".
• # TODO(rust): markers on the three things a Rust rewrite deletes: npmDepsHash, the sibling-symlink block, and the strip-types bin shim.

Why flake-check-as-CI, not a Node workflow

convoy depends on smalltalk and pty via file:../sibling. A plain npm ci in CI needs both repos checked out next to convoy — there is no clean way for a GitHub workflow to arrange that. Flake inputs solve it properly: the sibling packages come from their own flakes, pinned in flake.lock.

.github/workflows/nix.yml is modeled on pty's existing one (PR + push to main, ubuntu-latest, DeterminateSystems/determinate-nix-action@v3) but runs nix flake check rather than nix build, so the checks actually gate rather than only the package building.

Checks — all against a real built binary

check	what it proves
help	convoy --help runs from the installed binary
completions	generates bash/zsh/fish, asserts each is non-empty, that fish still binds to convoy, and that each shell accepts its own generated script (bash -n / zsh -n / fish -n)
typecheck	convoy's own npm run typecheck (tsc --noEmit), against the same sibling deps the package links
parity	src/completions.test.ts — the suite that keeps the command table, argv dispatch, and the generated scripts from drifting. Nothing ran it automatically before this

checks.completions is where zsh actually gets syntax-checked — it is often absent from a dev machine, so the unit test in #85 skips it locally. Here it is guaranteed.

Gap, stated honestly

The full vitest suite is not wired up as a check — only the completions parity file. Parts of the rest shell out to git worktree and probe the host, which the Nix sandbox cannot provide, so forcing it in would mean either a red check or carving the suite up, neither of which belongs here. So nix flake check covers build + help + completions + typecheck + the parity suite, and the remaining npm test coverage stays a local step. Worth revisiting by splitting the host-dependent tests behind a marker.

Verification (observed, on x86_64-linux)

• nix build .#default — succeeds. npmDepsHash = "sha256-RCsVWvgt0853fww5A89GDDd9OR2aexf23dAnn7EDq1M=", computed by letting the build fail on a placeholder and taking the reported got: value.
• nix flake check — passes: checks.help, checks.typecheck, checks.completions, checks.parity all green. The parity check's log shows 31 passed, with the bash/zsh/fish syntax assertions actually running rather than skipping.
• ./result/bin/convoy --help — prints the subcommand listing.
• ./result/bin/convoy --version — 0.2.0-ts.0.
• ./result/bin/convoy completions fish — 186 lines; bash/zsh also emit and pass their -n check inside the sandbox.
• Completions land at share/bash-completion/completions/, share/fish/vendor_completions.d/, share/zsh/site-functions/.

nix flake check was only run for the host system; the other platforms are evaluated but not built (standard eachDefaultSystem behavior).